Gunra Cross-Region/Cross-Subscription Backup Vault Deletion Spree

Ankit Mehta@Secvyn

•updated Aug 11, 2026•6•2•4

This rule monitors for high-volume deletion of Azure Recovery Services backup items or vaults performed by a single user across multiple subscriptions or regions within a 2-hour window. This behavior is indicative of an attacker attempting to inhibit system recovery by destroying cloud backups before performing other destructive operations like ransomware or data wiping.